GHSA-32xf-7j44-xq72: [Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when GITHUB_WEBHOOK_SECRET is unset
The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUBWEBHOOKSECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set GITHUB_WEBHOOK_SECRET to a non-empty secret so the GitHub webhook HMAC signature check is enforced.
otterdog webapp GITHUB_WEBHOOK_SECRET = non-empty secret
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments where GITHUB_WEBHOOK_SECRET is unset or empty are exposed. The documented code default is None, so deployments that do not explicitly configure this value may be affected.
What does an attacker need to exploit this?
An attacker needs network access to the webapp and the ability to send a crafted GitHub webhook JSON body. No authentication, privileges, or user interaction are required when the webhook secret is unset or empty.
What can be done if patching is not immediately possible?
Configure GITHUB_WEBHOOK_SECRET with a non-empty value so that webhook HMAC signature validation is not skipped. Restricting network access to the webapp can also reduce exposure to untrusted clients.
How can I determine whether my deployment is affected?
Check the webapp configuration or runtime environment for GITHUB_WEBHOOK_SECRET. It is affected if the value is absent or empty; an unset value uses the None default.